Encryption and authentication of communications and content payload over existing networks

ABSTRACT

A server may receive encryption key requests that each identify a sender of the encryption key request and at least one recipient of information that is to be encrypted with the requested encryption key. In response, an encryption key may be sent to the sender of the encryption key request. Information identifying the sender and the at least one recipient may be stored. The server may receive decryption key requests that each identify a sender of the decryption key request and a sender of encrypted information. In response, a decryption key may be sent to the sender of the decryption key request if and only if the sender of encrypted information and the sender of the decryption key request, as both identified by the information in the decryption key request, match, respectively, a sender of an encryption key request and an associated recipient, as both identified by the stored information.

BACKGROUND

1. Technical Field

This disclosure relates to network communication systems, such ascellular communication networks, and to encryption.

2. Description of Related Art

Encrypting information that is communicated over a network, such asinstant messages, emails, documents, and multimedia content, can be ofgreat importance. Unfortunately, some networks are not configured in away that readily facilitates end-to-end encryption. For example, sendingencrypted messages between mobile devices may be limited to devices thatare both equipped with compatible solutions. In other cases, encryptionmay only be available within the boundaries of an enterprise. This canlimit implementation of message encryption as the service may not bewidespread enough to allow for cross enterprise (B2B) and consumer (B2C)communication, such as communications within medical trials withparticipants and additional security for password resets on bankaccounts.

SUMMARY

An encryption and decryption key server system may include a dataprocessing module that receives encryption key requests from a networkinterface that communicates information through a computer network. Eachencryption key request may include information identifying a sender ofthe encryption key request and at least one recipient of informationthat is to be encrypted with the requested encryption key. In responseto the receipt of each encryption key request, the data processingmodule may cause the network interface to send an encryption key to thesender of the encryption key request. The encryption key may enable theinformation to be encrypted. The data processing module may storeinformation identifying the sender of the encryption key request inassociation with the at least one recipient identified in the encryptionkey request.

The data processing module may receive decryption key requests from thenetwork interface. Each request may include information identifying asender of the decryption key request and a sender of encryptedinformation. In response to the receipt of each decryption key request,the data processing module may cause the network interface to send adecryption key to the sender of the decryption key request. Thedecryption key may be sent if and only if the sender of encryptedinformation and the sender of the decryption key request, as bothidentified by the information in the decryption key request, match,respectively, a sender of an encryption key request and an associatedrecipient, as both identified by the stored information.

An authentication module may authenticate the sender of each encryptionkey request. The data processing module may not cause an encryption keyto be sent to a sender of an encryption key request, unless the senderof the encryption key request is authenticated by the authenticationmodule.

The authentication module may authenticate the sender of each decryptionkey request. The data processing module may not cause a decryption keyto be sent to a sender of a decryption key request unless the sender ofthe decryption key request is authenticated by the authenticationmodule.

The encryption and decryption key server system may not send or receivethe encrypted information.

An enterprise server may be located within an enterprise domain andcontain the data storage system, the network interface, and the dataprocessing module. A proxy server may be located outside of theenterprise domain, and may receive each encryption key request, delivereach encryption key request to the enterprise server, receive eachencryption key from the enterprise server, send each encryption key tothe sender of the encryption key request, receive each decryption keyrequest, deliver each decryption key request to the enterprise server,receive each decryption key from the enterprise server, and send eachdecryption key to the sender of the decryption key request.

At least one of the encryption key requests may identify multiplerecipients of the information that is to be encrypted with the requestedencryption key.

The recipient may be identified by a phone number and the encryptedinformation may be an instant message.

The recipient may be identified by an email address and the encryptedinformation may be an email.

Each of the encryption and/or decryption keys may be different.

An encrypting communication device may include a data processing modulethat may cause a network interface configured to communicate informationthrough a computer network to send the encryption key request to theencryption and decryption key server system. The data processing modulemay receive the encryption key from the network interface in response tothe encryption key request. The data processing module may cause anencryption module to encrypt the information using the encryption key.The data processing module may cause the network interface to send theencrypted information to the at least one recipient identified in theencryption key request at an address that is different from the addressof the encryption and decryption key server system.

The data processing module may cause the network interface to deliverinformation indicative of the address of the encryption and decryptionkey server system to the at least one recipient, along with theencrypted information.

An authentication module may authenticate the sender to the encryptionand decryption key server system.

The encryption key request may identify multiple recipients of theinformation that is to be encrypted with the requested encryption key.

A decrypting communication device may include a data processing modulethat may receive encrypted information from a network interfaceconfigured to communicate information through a computer network. Thedata processing module may cause the network interface to send thedecryption key request to the encryption and decryption key serversystem at an address that is different than the address from which theencrypted information was received. The data processing module mayreceive the decryption key from the network interface in response to thedecryption key request. The data processing module may cause adecryption module to decrypt the encrypted information using thedecryption key.

The data processing module may receive the address of the encryption anddecryption key server system from the network interface along with theencrypted information.

An authentication module may authenticate the sender of the decryptionkey request to the encryption and decryption key server system.

Non-transitory, tangible, computer-readable media may contain a programof instructions configured to cause a computer system running theprogram of instructions to perform the functions recited herein.

These, as well as other components, steps, features, objects, benefits,and advantages, will now become clear from a review of the followingdetailed description of illustrative embodiments, the accompanyingdrawings, and the claims.

BRIEF DESCRIPTION OF DRAWINGS

The drawings are of illustrative embodiments. They do not illustrate allembodiments. Other embodiments may be used in addition or instead.Details that may be apparent or unnecessary may be omitted to save spaceor for more effective illustration. Some embodiments may be practicedwith additional components or steps and/or without all of the componentsor steps that are illustrated. When the same numeral appears indifferent drawings, it refers to the same or like components or steps.

FIG. 1 illustrates a network communication system that includes anencrypting communication device 101, a decrypting communication device103, and an encryption and decryption key server system 105.

FIG. 2 illustrates an example of the encrypting communication device 101illustrated in FIG. 1.

FIG. 3 illustrates an example of the encryption and decryption keyserver system 105 system illustrated in FIG. 1.

FIG. 4 illustrates an example of the decrypting communication device 103illustrated in FIG. 1.

FIG. 5 illustrates an alternate configuration of the networkcommunication system illustrated in FIG. 1.

FIG. 6 illustrates an enterprise configuration of the encryption anddecryption key server system illustrated in FIG. 1.

DETAILED DESCRIPTION OF ILLUSTRATIVE EMBODIMENTS

Illustrative embodiments are now described. Other embodiments may beused in addition or instead. Details that may be apparent or unnecessarymay be omitted to save space or for a more effective presentation. Someembodiments may be practiced with additional components or steps and/orwithout all of the components or steps that are described.

FIG. 1 illustrates a network communication system that includes anencrypting communication device 101, a decrypting communication device103, and an encryption and decryption key server system 105. Asillustrated in FIG. 1, the encrypting communication device 101 isconfigured to send an encryption key request to the encryption anddecryption key server system 105. In response, the encryption anddecryption key server system 105 is configured to return an encryptionkey to the encrypting communication device 101.

The encrypting communication device 101 is configured to encryptinformation using this encryption key. The encrypting communicationdevice 101 is configured to send this encrypted information, along withan unencrypted address of the encryption and decryption key serversystem 105, to the decrypting communication device 103. The address maybe in any form, such as a URL or an IP address.

The decrypting communication device 103 is configured to send adecryption key request to the encryption and decryption key serversystem 105 at the address it received from the encrypting communicationdevice 101. In response, the encryption and decryption key server system105 is configured to send a decryption key to the decryptingcommunication device 103. The decrypting communication device 103 isconfigured to decrypt the encrypted information using this decryptionkey.

The encrypting communication device 101 and the decrypting communicationdevice 103 may be of any type. For example, each may be a wirelessmobile communication device, such as a mobile phone, laptop computer,tablet computer, or PDA. Each may also be a wired communication device,such as a desktop computer.

The encrypting communication device 101, the decrypting communicationdevice 103, and the encryption and decryption key server system 105 areconfigured to communicate with one another over a computer network. Thecomputer network may consist of or include a cellular communicationnetwork, the internet, a WiFi network, a local area network, a wide areanetwork, or any combination of these.

FIG. 2 illustrates an example of the encrypting communication device 101illustrated in FIG. 1.

FIG. 3 illustrates an example of the encryption and decryption keyserver system 105 system illustrated in FIG. 1.

FIG. 4 illustrates an example of the decrypting communication device 103illustrated in FIG. 1. These devices may include additional components.

The encrypting communication device 101, the encryption and decryptionkey server system 105, and the decrypting communication device 103 has anetwork interface 201, 301, and 401, respectively. Each networkinterface is configured to communicate information through a computernetwork, such as through a computer network of any of the typesdiscussed above.

The encrypting communication device 101 includes a data processingmodule 205. The data processing module 205 is configured to cause thenetwork interface 201 to send the encryption key request to theencryption and decryption key server system 105. The encryption keyrequest includes information indentifying a sender of the encryption keyrequest and at least one recipient of information that is to beencrypted with the requested encryption key.

The sender of the encryption key request may be identified in any way.If the information to be encrypted is an instant message, for example,the sender may be identified by a phone number. If the information to beencrypted is an email, for example, the sender may be identified by anemail address. Other forms of identification may an addition or insteadbe used, such as an IP address and/or a URL.

The recipient may be identified in any way, such as in any of the waysjust discussed in connection with the sender. When the sender plans ondelivering the encrypted information to more than one recipient,multiple recipients may be identified in the encryption key request.

The network interface 301 in the encryption and decryption key serversystem 105 receives this encryption key request and passes it to thedata processing module 305 in the encryption and decryption key serversystem 105.

An authentication module 303 within the encryption and decryption keyserver system 105 may optionally seek to authenticate the senderidentified in the encryption key request. Any type of authentication maybe used. For example, the authentication module 303 may seekauthentication information from an Authentication, Authorization, andAccounting (AAA) server (not shown) that may be part of the computernetwork system. The authentication module 303 may in addition or insteadseek information from the encrypting communication device 101, such asinformation that may be present in a SIM card within the encryptingcommunication device and/or a user name and password. When requested, acorresponding authentication module 203 within the encryptingcommunication device 101 is configured to facilitate the delivery ofthis information back to the authentication module 303 in the encryptionand decryption key server system 105. The authentication approach mayconfirm the sender's and receiver's identity on the mobile network andreach out to an enterprise that originated the message to make sure thereceiver was in fact allowed to view the message, before a decryptionkey is provided. The authentication algorithm may include multiplesources of validation, including the mobile network, where the device isauthenticated, originating enterprise, where the origination anddestination phone numbers can be validated to have authorization to viewthe message content, and a password to authenticate the user.

If the authentication effort fails, the data processing module 305 inthe encryption and decryption key server system 105 may be configured tosend a message back to the encrypting communication device 101. Thismessage may advise the encryption and decryption key server system 105that authentication has failed. In this case, the data processing module305 does not return an encryption key to the encrypting communicationdevice 101.

If authentication is successful, on the other hand, the data processingmodule 305 is configured to cause the network interface 301 to send anencryption key to the sender of the encryption key request that isconfigured to enable the information to be encrypted.

The encryption key may be of any type and may be generated by the dataprocessing module 305 using any means. For example, the key may be asymmetric or an asymmetric key. The key encryption mechanism may be astandard one or a proprietary one. Public key/private key settings maybe used or a symmetric encryption key, depending on the algorithmavailable on the UE and the security requirements for that specificcontent. Another option is to use IBAKE or a similar approach. Thisapproach may remove the need to acquire a key on the originating side,as it may rely on a publicly known key for encryption. However, to thisapproach may require a multiparty message that is being sent encryptedto use different keys to different destinations, which may beinefficient. A key may be acquired by calculation, rather than a queryto a key server.

The data processing module 305 is also configured to store informationin a data storage system 307 identifying the sender of the encrypted keyrequest in association with each recipient identified in the encryptionkey request.

The encryption key is received by the network interface 201 in theencrypting communication device 101 and passed to an encryption module207 that is configured to encrypt the information using the encryptionkey. The data processing module 205 causes the encryption module 207 toencrypt the information using the encryption key.

The data processing module 205 is configured to cause the networkinterface 201 to send the encrypted information to the at least onerecipient identified in the encryption key request. The at least onerecipient is illustrated in FIG. 1 as the decrypting communicationdevice 103. The address of at least one recipient is different than theaddress of the encryption and decryption key server system 105. Theportion of the computer network system that is used to deliver theencrypted information may be an existing computer network system thatmay require no modification to facilitate the delivery of thisinformation. For example, this portion of the computer network may be acellular communication network, the internet, a WiFi network, a localarea network, a wide area network, or any combination of these.

Along with the encrypted information, the data processing module 205 maybe configured to cause the address of the encryption and decryption keyserver system 105 to be delivered to the at least one recipient, alongwith the encrypted information. In other configurations, this addressinformation may not be send.

If more than a single recipient was identified in the encryption keyrequest, the data processing module 205 may cause the network interface201 to also send the encrypted information and, optionally, the addressof the encryption and decryption key server system 105, to each of theother designated recipients, again at addresses that are different thanthe address of the encryption and decryption key server system 105.Again, the portion of the computer network system that is used todeliver this encrypted information to each of the other recipients maybe an existing computer network system that may require no modificationto facilitate the delivery of this information. For example, thisportion of the computer network may be a cellular communication network,the internet, a WiFi network, a local area network, a wide area network,or any combination of these.

The encryption and decryption key server system 105 may never send orreceive any of the encrypted information.

The encrypted information and any address that is provided with it arereceived by the network interface 401 in the decrypting communicationdevice 103. An authentication module 403 may be configured toauthenticate the encrypting communication device 101 using any type ofauthentication, such as any of the types discussed above. In such acase, the authentication module 203 in the encrypting communicationdevice 101 is configured to provide whatever information is needed aspart of this authentication process.

If the authentication fails, a data processing module 405 in thedecrypting communication device 103 may be configured to send anotification back to the encrypting communication device 101, advisingthat authentication has failed. The data processing module 405 may inthis event be configured not to proceed further with the decryptionprocess.

If authentication succeeds, on the other hand, the data processingmodule 405 is configured to cause the network interface 401 to send thedecryption key request to the encryption and decryption key serversystem 105. If the address of the encryption and decryption key serversystem 105 was included along with the encrypted information from theencrypting communication device 101, the data processing module 405 isconfigured to send the decryption key request to the encryption anddecryption key server system 105 at this address. If the address is notprovided, the data processing module 405 may be configured to send thedecryption key request to a pre-programmed address for the encryptionand decryption key server system 105, or to another server that mayreturn this address. In any case, the address to which the decryptionkey request is sent is different than the address of the encryptingcommunication device 101.

The decryption key request includes information identifying the senderof the decryption key request and the sender of the encryptedinformation. Each sender may be identified in any way, such as in any ofthe ways discussed above in connection with the encryption key request.

The decryption key request is received by the network interface 301 inthe encryption and decryption key server system 105.

The authentication module 303 may be configured to authenticate thedecrypting communication device 103. It may do so using any type ofauthentication, such as any of the types discussed above. Theauthentication module 403 in the decrypting communication device 103 isconfigured to provide any authentication information that may berequired.

If authentication fails, the encryption and decryption key server system105 may be configured to provide notification of the failure to thedecrypting communication device 103, following which the encryption anddecryption key server system 105 will not provide any decryption key tothe decrypting communication device 103.

If authentication is successful, on the other hand, the data processingmodule 305 within the encryption and decryption key server system 105 isconfigured to query the data storage system 307. The query is configuredto determine whether the sender of the encrypted information and thesender of the decryption key request, as both identified by theinformation in the decryption key request, match, respectively, a senderof an encryption key request and an associated recipient, as bothidentified by the information in the data storage system 307. If thereis a match, the data processing module 305 is configured to cause thenetwork interface 301 to send the decryption key to the sender of thedecryption key request.

The decryption key that the data processing module 405 sends back isconfigured to enable the decrypting communication device 103 to decryptthe encrypted information that it received from the encryptingcommunication device 101. The exact form of the decrypting key willdepend upon the form of an encryption that was used by the encryptingcommunication device 101 in the first instance. One example is the useof PKI setting that has been used over the Internet where the originatoris issued a public key to encrypt content that is later decrypted onlywith a paired private key. Another example is a symmetric key where thesame key is issued for both origination and destination devices. A stillfurther example is the use of IBAKE-based encryption, where the key onthe sending side is calculated using a “known secret”, but may requirethe key authority to provide the decryption key. This approach may be anevolution of the PKI based key and may eliminate the need for to theserver on the sending side. It may, however, be inefficient formultiparty messages. As with IBAKE-based encryption, the key may bedestination dependent, and may require messages to be encryptedseparately for each destination. The key authority component may supportmultiple encryption schemes to overcome possible optimization concerns.

When returned, the decryption key is received by the network interface401 and passed to a decryption module 407. The data processing module405 is configured to cause the decryption module 407 to decrypt theencrypted information using the decryption key.

FIG. 5 illustrates an alternate configuration of the networkcommunication system illustrated in FIG. 1. As illustrated in FIG. 5,the encrypting communication device 101, the decrypting communicationdevice 103, and the encryption and decryption key server system 105remain present. Each of these is configured with the same components andis configured to perform the same functions as described above inconnection with FIGS. 1-4.

One difference between the embodiment shown in FIG. 5 and that shown inFIG. 1, however, is that the data processing module 205 in theencrypting communication device 101 is configured to deliver theencrypted information, along with any optional address that is provided,to an encrypted information server 501, rather than to the decryptingcommunication device 103. Thus, unlike the embodiment shown in FIG. 1,in which the encrypted information and key server address iscommunicated directly from the encrypting communication device 101 tothe decrypting communication device 103, a trusted intermediary(encrypted information server 501) is used to communicate theinformation indirectly. This enables the information to be communicated,even if the decrypting communication device 103 is not able to receivethe information at the time it is delivered by the encryptingcommunication device 101.

The encrypted information server 501 is configured to receive and storethe encrypted information, such as encrypted instant messages, emails,documents, and/or multimedia content, along with any address informationthat is provided. The encrypted information server 501 may also functionas an instant messaging server, an email server, a document server,and/or a multimedia server.

The encrypted information server 501 may be configured with anauthentication module (not shown) that may require authentication of theencrypting communication device 101 before accepting any encryptedinformation and related address for storage. Again, any type ofauthentication may be used, such as any of the types discussed above.

Correspondingly, the decrypting communication device 103 is configuredto receive the encrypted information, along with any optional addressthat is provided, from the encrypted information server 501, rather thanfrom the encrypting communication device 101. The decryptingcommunication device 103 may be configured to request this informationfrom the encrypted information server 501, in which case the encryptedinformation server 501 is configured to return it in response. This maybe done, for example, on demand or in accordance with a schedule. Theencrypted information server 501 may instead be configured to push thisinformation to the decrypting communication device 103. Again, this maybe done on demand or in accordance with a schedule. In either case, theencrypted information server 501 may be configured to requireauthentication of the decrypting communication device 103 beforeproviding any encrypted information and/or related address. Again, anytype of authentication may be used, such as any of the types discussedabove.

FIG. 6 illustrates an enterprise configuration of the encryption anddecryption key server system illustrated in FIG. 1. As illustrated inFIG. 6, the network interface 301, the data processing module 305, datastorage system 307, and the authentication module 303 are housed withinan enterprise server 601 within an enterprise domain 603. The enterpriseserver is configured to authenticate the user in the enterprise and maygovern the use of specific encryption schemes approved by the enterpriseto guarantee a level of security. A proxy server 605 is located outsideof the enterprise domain 603 and configured to receive each encryptionkey request from encryption communication devices, deliver eachencryption key request to the enterprise server, receive each encryptionkey from the enterprise server 601 in response, send each encryption keyback to the sender of the encryption key request, receive eachdecryption key request from a decrypting communication device, delivereach decryption key request to the enterprise server 601, receive eachdecryption key from the enterprise server 601 in response, and send eachdecryption key to the sender of the decryption key request. In thisconfiguration, the encryption and decryption key server system may beconstrued to cover both the enterprise server 601 and the proxy server605, as illustrated in FIG. 6. Alternatively, the encryption anddecryption key server system may be construed to cover just theenterprise server 601.

Encrypting and decrypting communication devices 101 and 103, theencryption and decryption key server system 105, the enterprise server601, and the proxy server 605 may each be implemented with a computersystem configured to perform the functions that have been describedherein for the component and its subcomponents. Each computer systemincludes one or more processors, memory devices (e.g., random accessmemories (RAMs), read-only memories (ROMs), and/or programmable readonly memories (PROMS)), tangible storage devices (e.g., hard diskdrives, CD/DVD drives, and/or flash memories), system buses, videoprocessing components, network communication components, input/outputports, and/or user interface devices (e.g., keyboards, pointing devices,displays, microphones, sound reproduction systems, and/or touchscreens).

Each computer system may include one or more computers at the same ordifferent locations. When at different locations, the computers may beconfigured to communicate with one another through a wired and/orwireless network communication system.

Each computer system may include software (e.g., one or more operatingsystems, device drivers, application programs, and/or communicationprograms). When software is included, the software includes programminginstructions and may include associated data and libraries. Whenincluded, the programming instructions are configured to implement oneor more algorithms that implement one more of the functions of thecomputer system, as recited herein. Each function that is performed byan algorithm also constitutes a description of the algorithm. Thesoftware may be stored on one or more non-transitory, tangible storagedevices, such as one or more hard disk drives, CDs, DVDs, and/or flashmemories. The software may be in source code and/or object code format.Associated data may be stored in any type of volatile and/ornon-volatile memory.

Non-transitory, tangible, computer-readable media may be used. The mediamay contain a program of instructions configured to cause a computersystem running the program of instructions to receive the encryption keyrequests, each including information identifying a sender of theencryption key request and at least one recipient of information that isto be encrypted with the requested encryption key. The programminginstructions may cause the computer system, in response to the receiptof each encryption key request, to: send an encryption key to the senderof the encryption key request configured to enable the information to beencrypted and store information in the data storage system identifyingthe sender of the encryption key request in association with the atleast one recipient identified in the encryption key request. Theprogramming instructions may further cause the computer system toreceive the decryption key requests and, in response, may send adecryption key to the sender of the decryption key request if and onlyif the sender of encrypted information and the sender of the decryptionkey request, as both identified by the information in the decryption keyrequest, match, respectively, a sender of an encryption key request andan associated recipient, as both identified by the information in thedata storage system.

The components, steps, features, objects, benefits and advantages thathave been discussed are merely illustrative. None of them, nor thediscussions relating to them, are intended to limit the scope ofprotection in any way. Numerous other embodiments are also contemplated.These include embodiments that have fewer, additional, and/or differentcomponents, steps, features, objects, benefits and advantages. Thesealso include embodiments in which the components and/or steps arearranged and/or ordered differently.

For example, encryption schemes may allow further optimization in flows.This may eliminate steps required on originator or destination side,and/or may allow the client to cache out encryption keys for a longertime, eliminating the need for a per message call to the server.

Unless otherwise stated, all measurements, values, ratings, positions,magnitudes, sizes, and other specifications that are set forth in thisspecification, including in the claims that follow, are approximate, notexact. They are intended to have a reasonable range that is consistentwith the functions to which they relate and with what is customary inthe art to which they pertain.

All articles, patents, patent applications, and other publications thathave been cited in this disclosure are incorporated herein by reference.

The phrase “means for” when used in a claim is intended to and should beinterpreted to embrace the corresponding structures and materials thathave been described and their equivalents. Similarly, the phrase “stepfor” when used in a claim is intended to and should be interpreted toembrace the corresponding acts that have been described and theirequivalents. The absence of these phrases in a claim mean that the claimis not intended to and should not be interpreted to be limited to any ofthe corresponding structures, materials, or acts or to theirequivalents.

The scope of protection is limited solely by the claims that now follow.That scope is intended and should be interpreted to be as broad as isconsistent with the ordinary meaning of the language that is used in theclaims when interpreted in light of this specification and theprosecution history that follows and to encompass all structural andfunctional equivalents. Notwithstanding, none of the claims are intendedto embrace subject matter that fails to satisfy the requirement ofSections 101, 102, or 103 of the Patent Act, nor should they beinterpreted in such a way. Any unintended embracement of such subjectmatter is hereby disclaimed.

Except as stated immediately above, nothing that has been stated orillustrated is intended or should be interpreted to cause a dedicationof any component, step, feature, object, benefit, advantage, orequivalent to the public, regardless of whether it is or is not recitedin the claims.

The invention claimed is:
 1. An encryption and decryption key serversystem comprising: a data storage system configured to store andretrieve data; a network interface configured to communicate informationthrough a computer network; and a data processing module configured to:receive an encryption key request from the network interface, theencryption key request including information identifying a sender of theencryption key request and identifying at least one recipient ofinformation that is to be encrypted with the requested encryption key;in response to the receipt of each encryption key request: cause thenetwork interface to send an encryption key to the sender of theencryption key request configured to enable the information to beencrypted; and store information in the data storage system identifyingthe sender of the encryption key request in association with the atleast one recipient identified in the encryption key request; receive adecryption key request from the network interface, the decryption keyrequest including information identifying a sender of the decryption keyrequest and a sender of the encrypted information; and in response tothe receipt of each decryption key request, cause the network interfaceto send a decryption key to the sender of the decryption key request ifand only if a) the sender of the encrypted information and the sender ofthe decryption key request, as both identified by the information in thedecryption key request, match, respectively, b) the sender of theencryption key request and the at least one recipient of saidinformation to be encrypted with the requested encryption key, as bothidentified by the encryption key request.
 2. The encryption anddecryption key server system of claim 1 further comprising anauthentication module configured to authenticate the sender of theencryption key request and wherein the data processing module isconfigured prohibit the encryption key from being sent to the sender ofthe encryption key request unless the sender of the encryption keyrequest is authenticated by the authentication module.
 3. The encryptionand decryption key server system of claim 1 further comprising anauthentication module configured to authenticate the sender of thedecryption key request and wherein the data processing module isconfigured prohibit the decryption key from being sent to the sender ofa decryption key request unless the sender of the decryption key requestis authenticated by the authentication module.
 4. The encryption anddecryption key server system of claim 1 wherein the encryption anddecryption key server system does not send or receive the encryptedinformation.
 5. The encryption and decryption key server system of claim1 further comprising: an enterprise server that is located within anenterprise domain and that contains the data storage system, the networkinterface, and the data processing module; and a proxy server that islocated outside of the enterprise domain and that is configured to:receive the encryption key request; deliver the encryption key requestto the enterprise server; receive the encryption key from the enterpriseserver; send the encryption key to the sender of the encryption keyrequest; receive the decryption key request; deliver the decryption keyrequest to the enterprise server; receive the decryption key from theenterprise server; and send the decryption key to the sender of thedecryption key request.
 6. The encryption and decryption key serversystem of claim 1 wherein the encryption key request identifies multiplerecipients of the information that is to be encrypted with the requestedencryption key.
 7. The encryption and decryption key server system ofclaim 1 wherein the at least one recipient of said information to beencrypted with the requested encryption key is identified by a phonenumber and wherein the encrypted information is an instant message. 8.The encryption and decryption key server system of claim 1 wherein theat least one recipient is identified by an email address and theencrypted information is an email.
 9. The encryption and decryption keyserver system of claim 1 wherein the encryption key is one of aplurality of encryption keys that are different from each other.
 10. Anencrypting communication device comprising: a network interfaceconfigured to communicate information through a computer network; anencryption module configured to encrypt information using an encryptionkey which is to be decrypted by a decryption module; and a dataprocessor configured to: cause the network interface to send anencryption key request to an encryption and decryption key server systemat an address, the encryption key request including al informationidentifying a sender of the encryption key request and b) at least onerecipient of information that is to be encrypted with the requestedencryption key; receive an encryption key from the network interface inresponse to the encryption key request; cause the encryption module toencrypt the information using the encryption key; and cause the networkinterface to: 1) send the encrypted information to the at least onerecipient identified in the encryption key request at an address that isdifferent from the address of the encryption and decryption key serversystem; and 2) cause the decryption module to send to the encryption anddecryption key server system a decryption key request which identifiesthe sender of the encrypted information and the decryption module whichis the sender of the decryption key request.
 11. The encryptingcommunication device of claim 10 wherein the data processor isconfigured to cause the network interface to deliver informationindicative of the address of the encryption and decryption key serversystem to the at least one recipient along with the encryptedinformation.
 12. The encrypting communication device of claim 10 furthercomprising an authentication module configured to authenticate thesender to the encryption and decryption key server system.
 13. Theencrypting communication device of claim 10 wherein the encryption keyrequest identifies multiple recipients of the information that is to beencrypted with the requested encryption key.
 14. The encryptingcommunication device of claim 10 wherein the at least one recipient isidentified by a phone number and wherein the encrypted information is aninstant message.
 15. The encrypting communication device of claim 10wherein the at least one recipient is identified by an email address andwherein the encrypted information is an email.
 16. The encryptingcommunication device of claim 10 wherein the address to which theencrypted information is sent is the address of the recipient.
 17. Theencrypting communication device of claim 10 wherein the address to whichthe encrypted information is sent is the address of an encryptedinformation server.
 18. A decrypting communication device comprising: anetwork interface configured to communicate information through acomputer network; an decryption module configured to decrypt encryptedinformation received from an encryption module using a decryption key;and a data processor configured to: receive encrypted information fromthe network interface that the network interface received from anaddress; cause the network interface to send a decryption key request toan encryption and decryption key server system at an address that isdifferent than the address from which the encrypted information wasreceived, the decryption key request including information identifying asender of the decryption key request and a sender of the encryptedinformation; receive a decryption key from the network interface inresponse to the decryption key request if and only if a) the sender ofthe encrypted information and the sender of the decryption key request,as both identified by the information in the decryption key request,match, respectively, b) the sender of the encryption key request asidentified by the information in the encryption key request; and causethe decryption module to decrypt the encrypted information using thedecryption key.
 19. The decrypting communication device of claim 18further comprising an authentication module configured to authenticatethe sender to the encryption and decryption key server system.
 20. Thedecrypting communication device of claim 18 wherein the sender of theencrypted information identified by an email address and wherein theencrypted information is an email.
 21. The decrypting communicationdevice of claim 18 wherein the address from which the encryptedinformation is received is the address of the sender.
 22. The decryptingcommunication device of claim 18 wherein the address to which theencrypted information is sent is the address of an encrypted informationserver.